⬢ DragonFlyBSD Kernel Audit
DF-3480 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
{
  "finding_id": "DF-3480",
  "verdict": "not_reproduced (anomaly demonstrated; corruption not captured)",
  "impact": "none (demonstrated: socket wedge/silent data loss; unproven: sockbuf corruption/UAF)",
  "reproduce": {
    "build": "make (btsbx.ko kernel module) + cc -pthread -o df3478_drive df3478_drive.c   [requires DF-3478 & DF-3479 fixes applied to ng_btsocket.ko]",
    "run": "load modules; sysctl debug.btsbx.cmd=1,2,3,4; ./df3478_drive 240 8",
    "expected": "no crash; readers starve after a handful of reads while FIONREAD reports thousands of queued bytes and a fresh select()+read() succeeds — the unsynchronized-sockbuf signature"
  },
  "kernel_refs": [
    "sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:1455",
    "sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c:1529",
    "sys/kern/uipc_sockbuf.c:176",
    "sys/kern/uipc_socket.c:1831"
  ],
  "artifacts": ["README.md", "run.log", "btsbx.c", "df3478_drive.c", "Makefile", "verdict.json", "manifest.json"]
}